cbcvebase.
CVE-2010-1900
published 2010-08-11

CVE-2010-1900: Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP2; Microsoft Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Word Viewer…

PriorityP261critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
39.81%
98.5th percentile
Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP2; Microsoft Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Word Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2; and Works 9 do not properly handle malformed records in a Word file, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, aka "Word Record Parsing Vulnerability."

Affected

7 ranges
VendorProductVersion rangeFixed in
microsoftoffice——
microsoftoffice——
microsoftoffice_compatibility_pack——
microsoftword——
microsoftword——
microsoftword——
microsoftworks——

Detection & IOCsextracted from sources · hover to see the quote

urlhttps://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14971.zip↗
bytes↗
\x47\xCA\xFF
bytes↗
\x3E\xC6\xFF
  • →Detect malicious Word documents exploiting CVE-2010-1900 by scanning for the sprmCMajority (0x47CA) byte sequence followed by sprmPAnld80 (0x3EC6) within .doc file content, indicative of the crafted record parsing buffer overflow trigger. ↗
  • →CVE-2010-1900 was used in infection chains requiring no user interaction beyond opening a malicious .doc file with a vulnerable version of MS-Word; triage any .doc file triggering memory corruption on Word 2002 SP3, 2003 SP3, or 2007 SP2. ↗
  • →The exploit modifies bytes at offset 4082–4088 of a source .doc file, inserting the malicious sprmCMajority and sprmPAnld80 records; file-format parsers or YARA rules should flag .doc files with these sprm opcodes at anomalous positions. ↗
  • ·The exploit targets specifically Word 2007 SP2; other affected versions (Word 2002 SP3, 2003 SP3, Office 2004/2008 for Mac, Open XML File Format Converter, Word Viewer, Compatibility Pack SP2, Works 9) may produce different byte-level artifacts and the exact offset (4082–4088) may not apply universally. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.